2

I am trying to generate a certificate for serving both from localhost and other names

I used the following commands

openssl genrsa -out nebula3.key 1024
openssl req -key nebula3.key -new -out nebula3.req -subj '/C=RU/ST=Moscow/L=Moscow/O=In The Moon Network/OU=/CN=nebula3/emailAddress=dims12@mail.ru/subjectAltName=DNS.1=localhost,DNS.2=nebula3.inthemoon.net'
openssl x509 -req -in nebula3.req -CA In+The+Moon+Authority.crt -CAkey In+The+Moon+Authority.key -CAserial file.srl -out nebula3.pem

Files In The Moon Authority.crt and In The Moon Authority.key are my own generated and self-signed CA.

Now I got certificate with

# openssl x509 -noout -subject -in nebula3.pem
subject= /C=RU/ST=Moscow/L=Moscow/O=In The Moon Network/CN=nebula3/emailAddress=dims12@mail.ru/subjectAltName=DNS.1=localhost,DNS.2=nebula3.inthemoon.net

unfortunately, when I am trying to serve with this certificate from localhost I get the following error

enter image description here

looks like Firefox doesn't like this certificate although it has localhost in alternative names.

May be I put incorrect SAN type? I see DNS here, which looks like type. What are other types possible and what is theis syntax?

In some web-ui I saw the following 4 types:

enter image description here

How can I specify them in command line? May be I could use IP?

7
  • SubjectAlternativeName must be an extension, NOT part of (an 'attribute' in) the Subject field; see security.stackexchange.com/questions/74345/… – dave_thompson_085 Nov 20 '16 at 11:56
  • certificates accept only FQDN....would localhost. (with the period) help? I would not add localhost to a X.509 certificate. – Rui F Ribeiro Nov 20 '16 at 12:40
  • @dave_thompson_085 what does it mean -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) in Linux? – Dims Nov 20 '16 at 13:25
  • @Rob this implies HTTPS can't be used with localhost, which can't be true – Dims Nov 20 '16 at 13:27
  • That method is actually more complex than needed. cat /etc/ssl/openssl.cnf <(printf ...) means run the printf command given then run cat and give it as arguments the filename /etc/ssl/openssl.cnf and a filename that reads the output from the printf; since cat outputs the concatenation of the files named by its arguments, this produces an output consisting of the contents of /etc/ssl/openssl.conf followed by the output produced by the printf command which here is an OpenSSL config section for a SAN extension.<(cat ...) then passes openssl -config a filename that reads ... – dave_thompson_085 Nov 20 '16 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.